f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399.exe
Size

1000KB
MD5

d52fc0d146adb944cb8cb03067dba3df
SHA1

0057f173d664153398bb8c4bbbe7f43fce50fcb9
SHA256

f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399
SHA512

eefaf923cd4ab76baf641bda56695894353ecdadd23cefb92b3564041f6419767bd3c993e00fb23147b2b454f427878ad90a8d1f00c2da636b29050cf86ba497
SSDEEP

12288:QfeD/HtHBFLPj3TmLnWrOxNuxC97hFq9o7:hD/HtHBFLPj368MoC9Dq9o7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcpllo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olkhmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjmhppqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dejacond.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmioonpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmmjgejj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jblpek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lingibiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmfbjnbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlncan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnhfee32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdcdbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbeqmoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbldaffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcedaheh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edpnfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elgfgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlopkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ghlcnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikopmkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imihfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ildkgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijkljp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpgmha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odocigqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjjbcbqj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anpncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nceonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeopki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iiffen32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hofdacke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mkgmcjld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkldb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbaemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijaida32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbapjafe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdcdbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcnnaikp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgnpgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfofbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajneip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphoelqn.exe

Executes dropped EXE 64 IoCs

pid	Process
4116	Fobiilai.exe
4312	Fflaff32.exe
3024	Fmficqpc.exe
4492	Fodeolof.exe
208	Gfnnlffc.exe
1008	Gmhfhp32.exe
2384	Gogbdl32.exe
516	Giofnacd.exe
448	Gcekkjcj.exe
4988	Gqikdn32.exe
2896	Gpklpkio.exe
920	Gbjhlfhb.exe
3848	Gjapmdid.exe
3968	Gidphq32.exe
2044	Gqkhjn32.exe
1888	Gcidfi32.exe
1020	Gbldaffp.exe
3724	Gjclbc32.exe
4340	Gifmnpnl.exe
1816	Gameonno.exe
2400	Gppekj32.exe
2364	Hboagf32.exe
3188	Hfjmgdlf.exe
4864	Hihicplj.exe
1596	Hapaemll.exe
5048	Hcnnaikp.exe
3948	Hbanme32.exe
4504	Hjhfnccl.exe
5024	Hikfip32.exe
4240	Hmfbjnbp.exe
3228	Hpenfjad.exe
748	Hcqjfh32.exe
4500	Hfofbd32.exe
4516	Hjjbcbqj.exe
1932	Hmioonpn.exe
3132	Hadkpm32.exe
4304	Hpgkkioa.exe
1432	Hbeghene.exe
1336	Hfachc32.exe
2344	Hippdo32.exe
3952	Hmklen32.exe
3220	Haggelfd.exe
1528	Hcedaheh.exe
3396	Hfcpncdk.exe
4836	Hjolnb32.exe
3684	Ibjqcd32.exe
404	Ijaida32.exe
1412	Impepm32.exe
628	Ipnalhii.exe
4596	Icjmmg32.exe
3512	Ifhiib32.exe
3076	Iiffen32.exe
4272	Imbaemhc.exe
1288	Icljbg32.exe
4808	Ibojncfj.exe
4072	Ijfboafl.exe
948	Iiibkn32.exe
4132	Iapjlk32.exe
4556	Idofhfmm.exe
4316	Ibagcc32.exe
3000	Ijhodq32.exe
2940	Iikopmkd.exe
5040	Iabgaklg.exe
3924	Idacmfkj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Fhjfhl32.exe	Ffkjlp32.exe
File created	C:\Windows\SysWOW64\Cibifp32.dll	Hcdmga32.exe
File created	C:\Windows\SysWOW64\Jmhale32.exe	Imfdff32.exe
File created	C:\Windows\SysWOW64\Nloiakho.exe	Njqmepik.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dmcibama.exe
File opened for modification	C:\Windows\SysWOW64\Hboagf32.exe	Gppekj32.exe
File created	C:\Windows\SysWOW64\Clpgpp32.exe	Cefoce32.exe
File created	C:\Windows\SysWOW64\Ckhindhb.dll	Fhgjblfq.exe
File created	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Mlcifmbl.exe	Miemjaci.exe
File created	C:\Windows\SysWOW64\Lafdhogo.dll	Mcpnhfhf.exe
File opened for modification	C:\Windows\SysWOW64\Ojgbfocc.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Bnkgeg32.exe	Bfdodjhm.exe
File created	C:\Windows\SysWOW64\Fojkiimn.dll	Icljbg32.exe
File created	C:\Windows\SysWOW64\Fbkmec32.dll	Jmpngk32.exe
File created	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Kbdmpqcb.exe	Kacphh32.exe
File created	C:\Windows\SysWOW64\Dbfmkjoa.dll	Gkaejf32.exe
File created	C:\Windows\SysWOW64\Honcnp32.dll	Jjbako32.exe
File created	C:\Windows\SysWOW64\Cefoce32.exe	Colffknh.exe
File created	C:\Windows\SysWOW64\Ffhoqj32.dll	Kfoafi32.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Nepgjaeg.exe
File opened for modification	C:\Windows\SysWOW64\Olmeci32.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Bhgejlhj.dll	Blbknaib.exe
File opened for modification	C:\Windows\SysWOW64\Hfnphn32.exe	Hcpclbfa.exe
File created	C:\Windows\SysWOW64\Lllcen32.exe	Lingibiq.exe
File created	C:\Windows\SysWOW64\Ghilmi32.dll	Cdfkolkf.exe
File opened for modification	C:\Windows\SysWOW64\Deoaid32.exe	Dbaemi32.exe
File created	C:\Windows\SysWOW64\Lfhdlh32.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Jdbnaa32.dll	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Phogofep.dll	Ibojncfj.exe
File created	C:\Windows\SysWOW64\Qknpkqim.dll	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Aglemn32.exe	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Dmgbnq32.exe
File created	C:\Windows\SysWOW64\Ffkjlp32.exe	Fhgjblfq.exe
File created	C:\Windows\SysWOW64\Mgdjapoo.dll	Icnpmp32.exe
File opened for modification	C:\Windows\SysWOW64\Jedeph32.exe	Jbeidl32.exe
File created	C:\Windows\SysWOW64\Olmeci32.exe	Ogpmjb32.exe
File opened for modification	C:\Windows\SysWOW64\Pcbmka32.exe	Pqdqof32.exe
File opened for modification	C:\Windows\SysWOW64\Hmioonpn.exe	Hjjbcbqj.exe
File opened for modification	C:\Windows\SysWOW64\Mpolqa32.exe	Mnapdf32.exe
File created	C:\Windows\SysWOW64\Jmehcnhg.dll	Ifgbnlmj.exe
File opened for modification	C:\Windows\SysWOW64\Lcbiao32.exe	Laalifad.exe
File opened for modification	C:\Windows\SysWOW64\Pdifoehl.exe	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Akichh32.dll	Baicac32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cfdhkhjj.exe
File created	C:\Windows\SysWOW64\Eddbig32.dll	Iapjlk32.exe
File created	C:\Windows\SysWOW64\Jaimbj32.exe	Jmnaakne.exe
File opened for modification	C:\Windows\SysWOW64\Kgbefoji.exe	Kmjqmi32.exe
File created	C:\Windows\SysWOW64\Ogifjcdp.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Agoabn32.exe	Accfbokl.exe
File opened for modification	C:\Windows\SysWOW64\Haggelfd.exe	Hmklen32.exe
File created	C:\Windows\SysWOW64\Mpablkhc.exe	Mmbfpp32.exe
File created	C:\Windows\SysWOW64\Jdeflhhf.dll	Nggjdc32.exe
File opened for modification	C:\Windows\SysWOW64\Klljnp32.exe	Kmijbcpl.exe
File created	C:\Windows\SysWOW64\Kiljkifg.dll	Mlcifmbl.exe
File created	C:\Windows\SysWOW64\Hfjmgdlf.exe	Hboagf32.exe
File created	C:\Windows\SysWOW64\Hcnnaikp.exe	Hapaemll.exe
File opened for modification	C:\Windows\SysWOW64\Gbiaapdf.exe	Gokdeeec.exe
File created	C:\Windows\SysWOW64\Ngmgne32.exe	Ndokbi32.exe
File opened for modification	C:\Windows\SysWOW64\Cnffqf32.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Ddonekbl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11276	12224	WerFault.exe	563

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mepgghma.dll"	Gmhfhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Elbmlmml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fakdpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imfdff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Imihfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogqnnn32.dll"	Dhkapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbfmkjoa.dll"	Gkaejf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Liimncmf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mbfkbhpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfpoqooh.dll"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cecenn32.dll"	Dbaemi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pniggbmk.dll"	Dlncan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbeghene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ijfboafl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkjmlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pldhcm32.dll"	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imllie32.dll"	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iiffen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhaebcen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kfankifm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eoaihhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hiefcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ikbnacmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kdnidn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qjoankoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ippohl32.dll"	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdeflhhf.dll"	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjlogcip.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhoilahe.dll"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdgpjm32.dll"	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbledndp.dll"	Imihfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anjekdho.dll"	Jdemhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Chmeobkq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clpgpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhpili32.dll"	Elgfgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enoogcin.dll"	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bfdodjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dodbbdbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbbgnpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qalnjkgo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmhfhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphqml32.dll"	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncnkogdb.dll"	Bbifelba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ligqhc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 4116	3600	f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399.exe	86
PID 3600 wrote to memory of 4116	3600	f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399.exe	86
PID 3600 wrote to memory of 4116	3600	f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399.exe	86
PID 4116 wrote to memory of 4312	4116	Fobiilai.exe	87
PID 4116 wrote to memory of 4312	4116	Fobiilai.exe	87
PID 4116 wrote to memory of 4312	4116	Fobiilai.exe	87
PID 4312 wrote to memory of 3024	4312	Fflaff32.exe	88
PID 4312 wrote to memory of 3024	4312	Fflaff32.exe	88
PID 4312 wrote to memory of 3024	4312	Fflaff32.exe	88
PID 3024 wrote to memory of 4492	3024	Fmficqpc.exe	89
PID 3024 wrote to memory of 4492	3024	Fmficqpc.exe	89
PID 3024 wrote to memory of 4492	3024	Fmficqpc.exe	89
PID 4492 wrote to memory of 208	4492	Fodeolof.exe	90
PID 4492 wrote to memory of 208	4492	Fodeolof.exe	90
PID 4492 wrote to memory of 208	4492	Fodeolof.exe	90
PID 208 wrote to memory of 1008	208	Gfnnlffc.exe	91
PID 208 wrote to memory of 1008	208	Gfnnlffc.exe	91
PID 208 wrote to memory of 1008	208	Gfnnlffc.exe	91
PID 1008 wrote to memory of 2384	1008	Gmhfhp32.exe	92
PID 1008 wrote to memory of 2384	1008	Gmhfhp32.exe	92
PID 1008 wrote to memory of 2384	1008	Gmhfhp32.exe	92
PID 2384 wrote to memory of 516	2384	Gogbdl32.exe	93
PID 2384 wrote to memory of 516	2384	Gogbdl32.exe	93
PID 2384 wrote to memory of 516	2384	Gogbdl32.exe	93
PID 516 wrote to memory of 448	516	Giofnacd.exe	94
PID 516 wrote to memory of 448	516	Giofnacd.exe	94
PID 516 wrote to memory of 448	516	Giofnacd.exe	94
PID 448 wrote to memory of 4988	448	Gcekkjcj.exe	95
PID 448 wrote to memory of 4988	448	Gcekkjcj.exe	95
PID 448 wrote to memory of 4988	448	Gcekkjcj.exe	95
PID 4988 wrote to memory of 2896	4988	Gqikdn32.exe	96
PID 4988 wrote to memory of 2896	4988	Gqikdn32.exe	96
PID 4988 wrote to memory of 2896	4988	Gqikdn32.exe	96
PID 2896 wrote to memory of 920	2896	Gpklpkio.exe	97
PID 2896 wrote to memory of 920	2896	Gpklpkio.exe	97
PID 2896 wrote to memory of 920	2896	Gpklpkio.exe	97
PID 920 wrote to memory of 3848	920	Gbjhlfhb.exe	98
PID 920 wrote to memory of 3848	920	Gbjhlfhb.exe	98
PID 920 wrote to memory of 3848	920	Gbjhlfhb.exe	98
PID 3848 wrote to memory of 3968	3848	Gjapmdid.exe	99
PID 3848 wrote to memory of 3968	3848	Gjapmdid.exe	99
PID 3848 wrote to memory of 3968	3848	Gjapmdid.exe	99
PID 3968 wrote to memory of 2044	3968	Gidphq32.exe	100
PID 3968 wrote to memory of 2044	3968	Gidphq32.exe	100
PID 3968 wrote to memory of 2044	3968	Gidphq32.exe	100
PID 2044 wrote to memory of 1888	2044	Gqkhjn32.exe	101
PID 2044 wrote to memory of 1888	2044	Gqkhjn32.exe	101
PID 2044 wrote to memory of 1888	2044	Gqkhjn32.exe	101
PID 1888 wrote to memory of 1020	1888	Gcidfi32.exe	102
PID 1888 wrote to memory of 1020	1888	Gcidfi32.exe	102
PID 1888 wrote to memory of 1020	1888	Gcidfi32.exe	102
PID 1020 wrote to memory of 3724	1020	Gbldaffp.exe	103
PID 1020 wrote to memory of 3724	1020	Gbldaffp.exe	103
PID 1020 wrote to memory of 3724	1020	Gbldaffp.exe	103
PID 3724 wrote to memory of 4340	3724	Gjclbc32.exe	104
PID 3724 wrote to memory of 4340	3724	Gjclbc32.exe	104
PID 3724 wrote to memory of 4340	3724	Gjclbc32.exe	104
PID 4340 wrote to memory of 1816	4340	Gifmnpnl.exe	105
PID 4340 wrote to memory of 1816	4340	Gifmnpnl.exe	105
PID 4340 wrote to memory of 1816	4340	Gifmnpnl.exe	105
PID 1816 wrote to memory of 2400	1816	Gameonno.exe	106
PID 1816 wrote to memory of 2400	1816	Gameonno.exe	106
PID 1816 wrote to memory of 2400	1816	Gameonno.exe	106
PID 2400 wrote to memory of 2364	2400	Gppekj32.exe	107

C:\Users\Admin\AppData\Local\Temp\f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399.exe
"C:\Users\Admin\AppData\Local\Temp\f4378fa04eddef5b23f1bc4dc858fce1150a85ae311198228a83515ce8032399.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\Fobiilai.exe
  C:\Windows\system32\Fobiilai.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\Fflaff32.exe
    C:\Windows\system32\Fflaff32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\SysWOW64\Fmficqpc.exe
      C:\Windows\system32\Fmficqpc.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4492
      - C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2384
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:516
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:920
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2044
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1888
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4340
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2364
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        24⤵
        Executes dropped EXE
        
        PID:3188
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        25⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        28⤵
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        29⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        30⤵
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        32⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        33⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4500
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4516
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        37⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        38⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1432
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        40⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        41⤵
        Executes dropped EXE
        
        PID:2344
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        43⤵
        Executes dropped EXE
        
        PID:3220
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        45⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4836
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        47⤵
        Executes dropped EXE
        
        PID:3684
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        49⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        50⤵
        Executes dropped EXE
        
        PID:628
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        51⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        52⤵
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3076
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        54⤵
        Executes dropped EXE
        
        PID:4272
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1288
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4808
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        58⤵
        Executes dropped EXE
        
        PID:948
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        60⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        61⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        62⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        64⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        65⤵
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        66⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1572
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        69⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        70⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        71⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3540
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        73⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        74⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        75⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        76⤵
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        77⤵
        
        PID:884
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1108
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        79⤵
        Drops file in System32 directory
        
        PID:3676
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        80⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        81⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        82⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        83⤵
        Drops file in System32 directory
        
        PID:1220
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        84⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        85⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        86⤵
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        87⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        88⤵
        Drops file in System32 directory
        
        PID:5272
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        89⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        90⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        91⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        92⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5452
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        94⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        95⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        96⤵
        Modifies registry class
        
        PID:5560
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        97⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        100⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        101⤵
        Drops file in System32 directory
        
        PID:5824
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        102⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        103⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        104⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        105⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        106⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        108⤵
        Modifies registry class
        
        PID:1800
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        109⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3536
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        111⤵
        Drops file in System32 directory
        
        PID:3428
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        112⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        113⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        114⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        115⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        116⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        117⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        119⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        120⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        121⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5792
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        123⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        126⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        127⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:368
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        129⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        130⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        131⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        132⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        133⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        134⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        135⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        136⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        137⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        138⤵
        
        PID:900
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        139⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        140⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        141⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        143⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        144⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        145⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        146⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        147⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        148⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        149⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        150⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        151⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4928
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        153⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        154⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        155⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        156⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        157⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        158⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        159⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        161⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        162⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        163⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6504
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        165⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        166⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        167⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        168⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        169⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        170⤵
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        171⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        172⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        173⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        174⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        175⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        177⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        178⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        179⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        180⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        181⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        182⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        183⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        184⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        185⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        186⤵
        Drops file in System32 directory
        
        PID:5788
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6548
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        189⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        191⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        192⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        193⤵
        Modifies registry class
        
        PID:6984
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        194⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        195⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        196⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        197⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        198⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        199⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        201⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        202⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        203⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        204⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        205⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        206⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        208⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        209⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        210⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        211⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        212⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        213⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        214⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        215⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        216⤵
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        218⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        219⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7340
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7376
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        222⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        223⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        224⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        225⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        226⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        227⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        228⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        229⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        230⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        231⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        232⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        234⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        235⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        236⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        238⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7320
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        240⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7528
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        242⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        243⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        244⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        245⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        246⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        247⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        248⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8040
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        250⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        251⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        252⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        253⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        254⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        255⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        256⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        257⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8184
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        258⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        259⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        262⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        263⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        264⤵
        Modifies registry class
        
        PID:8000
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        265⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        266⤵
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        267⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        268⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        269⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        270⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        271⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        272⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        273⤵
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        274⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8492
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        276⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        277⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        278⤵
        Drops file in System32 directory
        
        PID:8620
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        279⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        280⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        281⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        283⤵
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        284⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        285⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        286⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9004
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        288⤵
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        289⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        290⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        291⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9204
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        293⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        294⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        295⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8444
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        297⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        298⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8632
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        300⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        301⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        302⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        303⤵
        Drops file in System32 directory
        
        PID:8936
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9016
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        305⤵
        Modifies registry class
        
        PID:9108
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        306⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        307⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        308⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        309⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        310⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        311⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        312⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        313⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        314⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9104
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        316⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        317⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        318⤵
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        319⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        320⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        321⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        322⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        323⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        325⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9064
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        327⤵
        Modifies registry class
        
        PID:9156
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        328⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        329⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9292
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        331⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        332⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        333⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        334⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        335⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        336⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9592
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9632
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        339⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        340⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        341⤵
        Drops file in System32 directory
        
        PID:9756
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        342⤵
        Modifies registry class
        
        PID:9796
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        343⤵
        Drops file in System32 directory
        
        PID:9836
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        344⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        345⤵
        Drops file in System32 directory
        
        PID:9932
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        346⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        347⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        348⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        349⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        350⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        351⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        352⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9316
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        355⤵
        Drops file in System32 directory
        
        PID:9360
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        356⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        357⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        358⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        359⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        360⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        361⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        362⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        363⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        364⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10072
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        366⤵
        Drops file in System32 directory
        
        PID:10160
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        367⤵
        Drops file in System32 directory
        
        PID:10216
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        368⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        369⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        370⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        371⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        372⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9844
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        374⤵
        Modifies registry class
        
        PID:9920
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10068
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        376⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        377⤵
        Drops file in System32 directory
        
        PID:10224
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        378⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        379⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        380⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        381⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        382⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        383⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        384⤵
        Modifies registry class
        
        PID:9600
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        385⤵
        Modifies registry class
        
        PID:9996
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        386⤵
        Drops file in System32 directory
        
        PID:9304
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        387⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        388⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        389⤵
        Drops file in System32 directory
        
        PID:9536
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        390⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        391⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        392⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        393⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10464
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        395⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        396⤵
        Drops file in System32 directory
        
        PID:10600
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        397⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        398⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        399⤵
        Modifies registry class
        
        PID:10740
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        400⤵
        Drops file in System32 directory
        
        PID:10788
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        401⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        402⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        403⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        404⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        405⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        406⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        407⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        408⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        409⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        410⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        411⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        412⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        413⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        414⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        415⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        416⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        417⤵
        Modifies registry class
        
        PID:10728
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        418⤵
        Drops file in System32 directory
        
        PID:10804
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        419⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        420⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        421⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        422⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        423⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        424⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11200
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        425⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        426⤵
        Drops file in System32 directory
        
        PID:10336
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        427⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        428⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        429⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        430⤵
        Drops file in System32 directory
        
        PID:10876
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        431⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        432⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        433⤵
        Modifies registry class
        
        PID:11208
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        434⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        435⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        436⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        437⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        438⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        439⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        440⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        441⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        442⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        443⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        444⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        445⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        446⤵
        Drops file in System32 directory
        
        PID:9616
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        447⤵
        Drops file in System32 directory
        
        PID:11312
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        448⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        449⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        450⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        451⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11520
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        453⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        454⤵
        Drops file in System32 directory
        
        PID:11596
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11648
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        456⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        457⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        458⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        459⤵
        Drops file in System32 directory
        
        PID:11812
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        460⤵
        Modifies registry class
        
        PID:11856
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        461⤵
        Drops file in System32 directory
        
        PID:11892
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        462⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        463⤵
        Modifies registry class
        
        PID:11972
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        464⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        465⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        466⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        467⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        468⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        469⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12224 -s 408
        470⤵
        Program crash
        
        PID:11276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 12224 -ip 12224
1⤵
PID:10752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnlgp32.exe

Filesize
1000KB

MD5
4f80721ea2cd22259357aa85f713a7cb

SHA1
b223e56eb52584bfaaa7df071b902af70f6bfbe5

SHA256
db892224493a336bef77287fc2563eb9ba4edaf09569b7ac1970ef522f8553fd

SHA512
5fd670c5456ee8d2f3ec0f545792c1d0286820305b13f3c2e296c5aa64b76b0db31326224e29afccd27f99e96295c9dbee8054a6b33035a9d4f167d637c19cf0

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
1000KB

MD5
0cec367a9d542eae3f34567f93d09153

SHA1
00b8f5254445266a85ee298f9771ced4fcee79dd

SHA256
695b2a753dbe8d739165b3042576c1379777aadedb9a7cf081a98b0ae3407505

SHA512
db5234e5393a131cea59c298ef6601ca02606745b0d6f540341a813e1b974cbbd88bfbf36ad618ff49f60b9f54be8fca51288816f38b81b8cdd90a1f53b0fb7e

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
1000KB

MD5
78e1344e826af40d2cb892847f0b0d73

SHA1
83351e46e45e27112e515891af4adf8c60a40aba

SHA256
b18de25bdb276d86b674acb119355bddf907ebb07e8e14a24b39ba2f463fdd59

SHA512
36462f9dd5813e8be020d77752eb651b0b9dd9bc2c8e88ad501082b0e039a09695311ccfa5b2b5097d54b4e506e4538fd1ef346e6636cca6f5773f7a48e3f134

Download Submit
C:\Windows\SysWOW64\Ddbbeade.exe

Filesize
1000KB

MD5
dc7f0b2e04b8526f501d29d5c160fffa

SHA1
8c619eb1dbda275c53254e437ea91cb109a7ced6

SHA256
3e4d463ecfe17cefb1bbef23dcc6e288dc81942e5ec608af735b63d054eff9fd

SHA512
f455cfe9f1db07e64375a4df0773495fdcbe691df109d02d490b8780839a4ae96338ee198a89aa06286d84e1b4a87928988819485693214fc963c141b544280b

Download Submit
C:\Windows\SysWOW64\Dhidjpqc.exe

Filesize
1000KB

MD5
7d36b2dc6769ef5cd39e6cfc4915bdcb

SHA1
aca62c3b56b1fd4a35d6ad19133ccbe397dafb75

SHA256
729e949a72948fab97a3e6b5857515615c35d431c119cc5616d8ffe59399b61b

SHA512
44d73263c57f212ccbadd92463f74f82a29db8e358faba06142264bb6480e9709d3a6e0b4afc51efc1d28118b9eaee25d0869be701a147e5107f57a677b4e89c

Download Submit
C:\Windows\SysWOW64\Fflaff32.exe

Filesize
1000KB

MD5
d3c1d37fe77371e7ffb00cb7061c08e7

SHA1
864111e5222c7d0030cf4f3960bec7eb711f5683

SHA256
1a9c693fb0aa94128fe09755b711863781553d8db3390108b1b7c3e244848832

SHA512
1b1ff529cd4d97d557b37286e35dd9db679e1706bd47687130b091ddbcccb8fe17758615b2be34e9b8ae3e50e6cd27d1b51bd5c8f220bc72917b67a78db42a1d

Download Submit
C:\Windows\SysWOW64\Fmficqpc.exe

Filesize
1000KB

MD5
e7e42f705284a4940f61127279b8b0a5

SHA1
e1eace2cbe0e050f92f6464c1788c016a4153dc7

SHA256
6df925808bbc169464fc88a08d67072da7447fbdee042f312a689581bf7da0a0

SHA512
28eb2b46a85cb5f813e67f22f86c7de1d0dde58d297005262fd278ce78772fd2a8dee5b18320ccb0b8828876fa1abd6048d33eb34161e3b07c5c87a726e51a1c

Download Submit
C:\Windows\SysWOW64\Fobiilai.exe

Filesize
1000KB

MD5
292f3e61455db053847928eb1167c47c

SHA1
9a23306df96e7c35ea3d0f2aa3f92416a6e25d5f

SHA256
59d25fca7c3c14c82ec9b15b381ac1df81d2b8b8a1d51816a6a4613333eb5cea

SHA512
8b797dee5d941d96b30ee33340cf920a5457083b8a99dbf9bc25fdb5174d8e59221405b439bec48fce3fa836cefdbaf53f8f9920a67b7ffe0f01f521be4eb74f

Download Submit
C:\Windows\SysWOW64\Fodeolof.exe

Filesize
1000KB

MD5
9c5130c05ed125229fcc8fbd44693ad3

SHA1
98fa4cd410f096db0407af8baa0c739837029f9c

SHA256
3b3c8ac8843684297d38830e641433cb74ec5f868d9b039781c990d71177ad57

SHA512
f2273160336501b321b79e795e041913aa5436e673b822d777689cd8ba1b22c6d75e21124dd7ec3bc386b170bd74fa1d31105f01bb4606feb5e17904ada54324

Download Submit
C:\Windows\SysWOW64\Gameonno.exe

Filesize
1000KB

MD5
de2e351e02154e5a5a3ab4af33df7007

SHA1
328bbe863ba4594d649ca8b6330c3a7d63fb5a1a

SHA256
3c9ebf5eeed6ffcb867a87da14501f6f2dadc9786a0edd601365dfd2ccfd801e

SHA512
4fe06a1db67807e24424fd16255d6ea25594bcaf691b1a42ed5b522ed21bed8d38e7791c86ab641191fef0f98daf9d3acb40e566eec12e66b244abb896c36e10

Download Submit
C:\Windows\SysWOW64\Gbjhlfhb.exe

Filesize
1000KB

MD5
e27297fa0b2464b8c9374920176b1c13

SHA1
d59cbfcbe22a32de7db586eae00577bc6de6893a

SHA256
bab33219298b03ccdd2f48f488405c4326004e43057d9b881cc0278dafc0cdc7

SHA512
3fd0faf6fc722fd6143aa29d3e4ad4c1f93a6800b6bfb09c1b3bf51c69ae110f36edf7a07aae1fd7c3283ccc1e7e2cae47c08afeec82d6768d4222eb240dccbc

Download Submit
C:\Windows\SysWOW64\Gbldaffp.exe

Filesize
1000KB

MD5
f9c558673ac5a869d768f240d55ac096

SHA1
59a226713d4070d549e8254cc476f50703d4bec9

SHA256
5c3c877d0f06c4197145196e76c064c71e4cee47664d9bf87eee6337073fc3ea

SHA512
3bd93b68a9ea35ca2b9a6c968486fb49dff6c34767ae52d98bc5c44531f98cd0ae3d8815bcd132a6ec22fd2c0a1f43f73a8757f44c8a19a04617edebe52f9b88

Download Submit
C:\Windows\SysWOW64\Gcekkjcj.exe

Filesize
1000KB

MD5
a1750431a4771f671d499b42b88ddf81

SHA1
ead6399a603d7650a986796710513b8ef4545126

SHA256
3f3bcada230ef5efa942c4b059cf0d57ea5a79d1739da6835cba488cfdcbe694

SHA512
7f8a1cca521d5bdf3aa44d7f563b4041797a8988d77456a13e695155ab9e38d6c86b23f8e704f2de997c19f2203ab90374ff8a4f49864c5c8be17a396c893310

Download Submit
C:\Windows\SysWOW64\Gcidfi32.exe

Filesize
1000KB

MD5
d4cd6a481852070e73128c24c3d69ccd

SHA1
b9b49fd3de6d224644d42cdcc13dc024e6325089

SHA256
a87d8efbcdc92b64936d6f48599413e1bdf41d3f5f99a0bdd08c05b88f29fc97

SHA512
608760b0981805ba991ac53e08d8114cf91a25efec61fb8d91be7964891e9f838c445a8fe6eefb26c1a3524d6fef94bb4c80e531741e1378de86586b2a81cbe8

Download Submit
C:\Windows\SysWOW64\Gfnnlffc.exe

Filesize
1000KB

MD5
94abaae8d506d7747c74a1d1c1b45014

SHA1
fb95848159816386beb801517054df614470728e

SHA256
989387ac2c381f6d88e05132d8e4c5dfcdf36c6c2df5c9b3e660b5e12a03c1dc

SHA512
09f5277c4c6652b281c1df08c0f052e261e2d6deb9b6009c7aece70562ed3af4c457cc666f60dfb87b0611cf413e4a5a37a5323736de6514b902742d40917d54

Download Submit
C:\Windows\SysWOW64\Gidphq32.exe

Filesize
1000KB

MD5
ead1ac68fbd3ec44192e85694b627b58

SHA1
37d2b32803fe2addcbaff91101664f2fca5dfc05

SHA256
2c244891c33a9930a4a47765cd656661c994a5bee189ace047432903e4a3eb0c

SHA512
73fb9942f8eccfa347db3d7713cdd4997344ea526f9fb7f2a98caa62673479ad59a48bc8fe8de6588575a61861015b0df8a5fcb4f27590c7c432df2a94193f53

Download Submit
C:\Windows\SysWOW64\Gifmnpnl.exe

Filesize
1000KB

MD5
8d63b50692862ffbf0d071d4c52c435c

SHA1
7bc7752a1dfd96ac25ce3369329b79bb627de893

SHA256
6016a7ee559b99b1ff024f65bd2058851c73adbc5aa85669b6c62a5630d3f71e

SHA512
bf45cb437f618ce944d8afd13e9ac6fa03c672ec707f7771a0d667341ea8c5468ee2729ed113bce703e62967f9c40d0ce20bf4fd97deae149f8ce206e6398813

Download Submit
C:\Windows\SysWOW64\Giofnacd.exe

Filesize
1000KB

MD5
9c046d851780ea07d259983ab3846adc

SHA1
587a0987dca1125add37dcd1cdcc4e0cb1a58353

SHA256
d66e429f0a4e1d04ad24c5efeae592abab0200d94baf3a5999f8f257cbd6495b

SHA512
80eba31d0e957ca4fd9db0a60372d8b306e354e4ac80a22b3367f361563f655aa345f28dcc5b6bb511a06ea16165998919a54a5d81efb615b82a8b95ad74f5e9

Download Submit
C:\Windows\SysWOW64\Gjapmdid.exe

Filesize
1000KB

MD5
41e81b5824efff4f650e82cc0f7e7b3b

SHA1
6c551a4a44180eb4264c29bf558207af9a865de7

SHA256
71d4b8bf1ef9eb1b474a162a6ebe0f4024c8a2d3bb5f048172a9736b0a5de943

SHA512
07b85322e4b1e012cb2c91624406680b2a8172b219b2d0a3cd14e64ed0c7fa4264cf9b01d90d8be13402ed2ca399c50cc093dca2441ca9237f5d89269b5adff8

Download Submit
C:\Windows\SysWOW64\Gjclbc32.exe

Filesize
1000KB

MD5
d268b43b5481b2242259bbd9ba14a72d

SHA1
e832015231d9ab1181b10c2b0b6891241e7a6b6b

SHA256
5ddf46e5490843bff01753721ab9098244ef3efb890ec331e70549b211593f00

SHA512
7698ec195769ad81db069935b02c62899d9aecaa8a0c87d64b78d342f37b94a6b8a13ad1d888e045587e724150de10cbfb3dc67cee6d1320283f9217671c230d

Download Submit
C:\Windows\SysWOW64\Gmhfhp32.exe

Filesize
1000KB

MD5
63905e01126365ebb8ee9b762096c0e2

SHA1
6c5c039776f68fdd81e80181a6162ca10c121fd7

SHA256
300e5a4efb90591597a38e217aa0e819e0af7ea5b6327bc170a8d8031bda093b

SHA512
ab466d98a4a313009c1794cb27a51f6ebc1b5557a52052e37cdf5711bad91f09630a73ab5745075b02dd2b739610a7c8a9c0d07979e2e6ceb3d92705fda7fb37

Download Submit
C:\Windows\SysWOW64\Gogbdl32.exe

Filesize
1000KB

MD5
601bbadcc75f92c86fd431a30378db95

SHA1
af13ab9eedd68583ea6237a59dfc0ec37432dc89

SHA256
1d6d81e290598eae16695fdf3bfab9746315244cef2ef48782f5cb19ba1dd210

SHA512
31c4082317588c7acba8495afae5d0263ac79d835169ca43ec8337c2a85df94ee2d2e5a835a337e57c195a9c0ba76ea6af3b32541b5d6b32e07c009540043d23

Download Submit
C:\Windows\SysWOW64\Gpklpkio.exe

Filesize
1000KB

MD5
ad0334873b423c3c6b6e82f053387f04

SHA1
8469ad2f8c70082b7ea9244869a4f1132a86e33b

SHA256
53fb9d98d920c21b5ae8857b1c8b5d34215d4a65ed39c16b8d891b032e3cd2c2

SHA512
e316b5cd546740653ffa8859f606afa40679166438bf0b80ae7e9835d4edabb87b8948c041d762f866a955665d28e3ed11fcb193ffc36d48ff66eb9fea70cefd

Download Submit
C:\Windows\SysWOW64\Gppekj32.exe

Filesize
1000KB

MD5
9122ee19896172b52bf8e79b08218a6e

SHA1
6544c1ff76fdcb6b70aa97a2b006f54bd1e2c6c4

SHA256
90a015ae945b6b7db2d96d0987f8ba2e02fc02e4565a5c2a5277da9ef596fbff

SHA512
5a7879a5f1b6ed65f036daae398d81ca48efe954966ac6c2a579930e36f7046bf5b81c5f9e8a61202f7e3faab024a69893aa214b4f14453d22be3cf07aee3eb6

Download Submit
C:\Windows\SysWOW64\Gqikdn32.exe

Filesize
1000KB

MD5
559b6984f8a4233b91f761df80e9cdd7

SHA1
30afd2f0875925e4d15e68d502056dec92300d0d

SHA256
ede4e84ec76fd558c74f839bda33c930399045c8adb0571d6333f22213a46194

SHA512
4b528ae8b4337217edf8a4721e71fb09bcde6bad28d2db8049276c62af4c1b248d87c92efcf8d2856ee79a5b0b6aca8dc72d3b65db79649f79bfa25d70cee601

Download Submit
C:\Windows\SysWOW64\Gqkhjn32.exe

Filesize
1000KB

MD5
f9e4f3731b35018566ebd02330aa23bc

SHA1
23413ec4cbc011ddf9bd92632b1c82c2859528ac

SHA256
48ec4cac8c1b17c41e6be2904c253b8ce46a49e0dad751f8cd3fd42b8bcf06d3

SHA512
2ee0f5980cdb871d79b79fecee9294b3ba5f45a05d7094042e4caee7a59037d556e9e9e8bf7c4c95660d86eb4a1593764a1f87cc8b4a9c3c82d68a4f9268b941

Download Submit
C:\Windows\SysWOW64\Hapaemll.exe

Filesize
1000KB

MD5
2ad474a62a92216250c420f43ae4dae1

SHA1
eae003f871a832fb0ca9fc9a9d5860024463edb3

SHA256
7da89f61e74fed10d85c0a6de703a86fc3f2b24df2888f08ae8bedacd2708db3

SHA512
4cf6a5d1b7af222655f30374002b8c110d6ce7d1c4ac54099a7dc1b31eda4c68870e10baf5c9d93eff9fed152e82dac1d77d74bd0820fe6b1b9de117f1a4abff

Download Submit
C:\Windows\SysWOW64\Hbanme32.exe

Filesize
1000KB

MD5
712ea8b5957b1bb83ef97b6270532a0f

SHA1
b782ac1b9e805caffed6346237806ff99edfb84d

SHA256
de364790182399296a0cb8b9b62ff9f0975640049d6af3294e0dfe7362ac851e

SHA512
c7cd7c951f74381cc2d8dd7a0de55ead73a30aa2387a343708b8653cba5b317b16b079214ee28a38b9af3643258fd7711fc215fcba5f5474cb57f1055272b04d

Download Submit
C:\Windows\SysWOW64\Hboagf32.exe

Filesize
1000KB

MD5
418a8f1031325dadc4c1d91878d9a020

SHA1
9a49786376fd9c69679f1c2780df2e7c39f20594

SHA256
e2afbee4c95403623fa939e5fcbd7510995353bb209b7d93804e1f28da4232d6

SHA512
509cff384d10885ddf7be7655b73e5f6e1f05183715ce9f4d99c53c51125e90cd71f2d24942a0cf87503eaa90be21cdfe5c276360e490311d10659ce897205c1

Download Submit
C:\Windows\SysWOW64\Hcnnaikp.exe

Filesize
1000KB

MD5
54bcc62dd82544c4b1501ff86e94035c

SHA1
d7093f999e6d781df96550a0f1a1ebe881b30776

SHA256
4cb582298d4b0de3349cd5ba34093e59df299ef5c4e6a8c4e2de5a096942eaba

SHA512
c0f5bb841b93c37dec47ae5300e0fc552763f40dce06727aec3340e8d42719adbfcd3c8841d850d6eb4b8952b1722de57e2490767d600c13c63ed259a711b2a2

Download Submit
C:\Windows\SysWOW64\Hcqjfh32.exe

Filesize
1000KB

MD5
7bec1f42005fcb5946ae58457ab394a1

SHA1
c365a20f57189c996a3fd9947427521c3fc664d8

SHA256
e5d6cb166bd6cfc8ebbcc74e0eac33e92559a3652aa9766ddb25b732b0b2bec5

SHA512
2a1d929a8eb9591921f4d503765f98db7903057346f52547d8df062026675bfbcaf124a202c30dcb6bdc209f5382950ad067ed45c790da5cfd062e005cb93002

Download Submit
C:\Windows\SysWOW64\Hfjmgdlf.exe

Filesize
1000KB

MD5
be35b746433d6554f8a31c4e4ff3fb15

SHA1
b6e1ea2caed9b76090ee360483762d2f6321eaf4

SHA256
2a86c7df25dddd801d18a5b9dcd209e48ed9f8ee176692e1d167c0a398432c50

SHA512
f6bcabe455b4fc9bee88c60a09d334ead6bd9a511d238d2a4db6ede181ee528f9c45389f40be1cee1d1221eac71837b4c4820d3a808d448070e3510178bc7d33

Download Submit
C:\Windows\SysWOW64\Hihicplj.exe

Filesize
1000KB

MD5
e5e220324df4f79c8f6a3e9e0c4aff36

SHA1
1a269e34621ee1ea2f46d1b919ee8c976680d975

SHA256
1c901215d6993b603e01ddd8314dfbcf69afe77bf8a798a22a922bd5cfad0dc3

SHA512
03e35c61f89e6d497d9091e6c6997610b91828850200eb5376c0405ed7e7bc4fba181112f5e336a43ac7234a8b4f8a1f76c598fd43103739274ffec428631ca2

Download Submit
C:\Windows\SysWOW64\Hikfip32.exe

Filesize
1000KB

MD5
1f05daf908823ba1a683bba7462acea4

SHA1
337a23fee92137c9c1ad0e1c171a9f0e3de152aa

SHA256
b998f6f2ae9d83d840de2cb1f4958a84d5389e2dcedea49084ea44a7931c541c

SHA512
602a7fa477ee26e9c908a348cfa9a0b882d735028ca83d37fd99057b401f9111e12baf86fad4780f154d6f7880e47b52f169e1bba369bd0e636ed79509cf7ae4

Download Submit
C:\Windows\SysWOW64\Hjhfnccl.exe

Filesize
1000KB

MD5
70d7ec3437e157b1038b217e06608386

SHA1
bbd3646e2870508c617ef6b8f372ed458b76d357

SHA256
7ea0127c33e1c9521b2b742e7a1e37a464d456f271229609164aac93810d88f2

SHA512
ee746887982fa091dbc97bf495aa15d9e509c74e5637a24f47d91b2caa9bd2618c610826be4c4901d61706d5ba027cf7430bb4d31b4b2cfb9a2621aaafa4200d

Download Submit
C:\Windows\SysWOW64\Hmfbjnbp.exe

Filesize
1000KB

MD5
7344ed1dd2706fed3ce80a050175be87

SHA1
2cdecf5a0c19441f14f62ec73dc961c08ebd94e2

SHA256
72c3999179d536f79345b31a33d6f56567d74ba95ea39040023807d2875c8193

SHA512
218563f6a8dd81e1d0e75bd5e90ef2fab3706c4712e2fddba588aa9a96959002445416899f8bdd75984db50075d27aadd30ff46045cc3e5ea30a6afc925c1731

Download Submit
C:\Windows\SysWOW64\Hpenfjad.exe

Filesize
1000KB

MD5
68d7d8f9b1622f5be145e3d38a84cbd1

SHA1
3b280f1c6d5e999d73a25b52b109d17cc481e1fc

SHA256
4a3c6f6b8ba8f473c0cac94c46430b1b9e796cbb445ef3b7aff63ce8dcae852d

SHA512
416c255bf6af08e24c64b1ae08b7bcba9dd02d09a7fbb3ce7631f9e59efa16d959223cc7fba5a4973d969fd07aa75afe90604c45e9ef7b09345195e936b9f6e3

Download Submit
C:\Windows\SysWOW64\Ickchq32.exe

Filesize
1000KB

MD5
4925bf022dca2dbd904fe0592ba6ac01

SHA1
53ab2789762ed35883a35e8a8a8e8fa5fb659877

SHA256
cf7f776285e0e8fde583358230d964ed30bea196fc5901fa5a919b25a14a9099

SHA512
5d0130664818d3578738f97763d8ed12fba2ca7425cf83a3b5b5142330f6ce84d6350b8735369f8b49f6676d4cdaf2066638b565bfb73c5164d32ce0a24f4a2c

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
1000KB

MD5
e18f512d85c41c186c7a5a7459df183a

SHA1
9775720444b2e8e54e9d9569a16f46a647031ab4

SHA256
22ffbb51e5aa41edf6b26ab019247a5dcf3aba467485e096c663df981165d5b8

SHA512
5130e3f628d38cd6aab509dc3fd16735cc342521015ed6f1eea5f1c70eafd91f2c1fd28329d3d36cd30f94c973fd2d2aa65d77e714f198025f3be69e8dedd8e9

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
1000KB

MD5
90a35ee41dbdc2a73568ff90c51e211d

SHA1
8ee3c7ff519fde07f042ac75efe26907cd43ca02

SHA256
f515b9f7f6471caef0466b01eb479f389beeb63c25598b3eb51ce19d83c8102e

SHA512
c3065011c37e7c129e0388116db666dd04cd198cb25c22ff65931fca9e5f6f560fa0db5422fdcee5e87dd7bba1592223ca51fb799f9db7cba165e0cb32f331f1

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
1000KB

MD5
9a1f6dbb41c1a269ce41c52d4563d710

SHA1
47aebcd7320d864585f27ffb797a5c5e72cd0b49

SHA256
f2fc865bad2117d5af8d2dadd5cb348db6949993e9449ea7bc0a9b915c9c9ff7

SHA512
57e9f451886aaf6fd8dfa152e188ed5f0aa08df3c304428d73d21f11798a5736548b989f4afafd54ed050b8d9007b9a371f5934d2cad8059ca7be202ccba8e9f

Download Submit
C:\Windows\SysWOW64\Pmcglkid.dll

Filesize
7KB

MD5
2528a424e21385f12eac8cac4bc54edc

SHA1
4ac351d759995716b1620fcbb9a988057c18334a

SHA256
827e58ba142e7cff97e9eef37b5c0afff0f97dca5257958b3c8ce6891b77e1c7

SHA512
29918c6aff7c402f0af95ebcb10c1ab70f91978cae1903d8f5ec4576f9cf5254698c266acfd08cb4b253bf20b1f3a8ff3d39413c6d7b79951d0f411e9028d8ad

Download Submit
C:\Windows\SysWOW64\Qgciaf32.exe

Filesize
1000KB

MD5
221a4a3fa511ee98f00bf7c2468cddcb

SHA1
3fee15a88bccd6ca90b829e10bbe68cc554f78ee

SHA256
220df7fef9f92dc072b176e9c8ed8f5091bcb21b4eaf679b2ae268e75f1204de

SHA512
ce2c4119ee644fdc4a249b3e6e9d04cb5af06988a3ccbd4cd46ad7ac4e5d4227b51e5ec4820f9f96ae10c2a817b872b47ee4cc9fd83fe56c72935c9cb838faba

Download Submit
memory/208-42-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/404-661-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/448-553-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/516-552-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/628-663-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/748-611-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/920-561-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/948-686-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1008-49-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1020-571-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1288-678-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1336-633-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1412-662-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1432-632-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1528-647-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1596-594-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1816-583-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1888-570-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1932-619-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2044-569-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2344-639-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2364-586-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2384-61-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2400-585-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2896-560-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2940-701-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3000-695-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3024-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3076-676-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3132-625-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3188-587-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3220-646-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3228-605-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3396-652-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3512-675-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3600-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3684-655-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3724-577-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3848-562-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3948-600-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3952-640-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/3968-563-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4072-685-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4116-8-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4132-687-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4240-604-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4272-677-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4304-626-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4312-16-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4316-694-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4340-578-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4492-32-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4500-612-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4504-602-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4516-618-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4556-693-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4596-669-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4808-684-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4836-654-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4864-593-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/4988-558-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5024-603-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5040-702-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/5048-595-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads